Executive brief
serve is a popular Node.js HTTP server package used to host static files and directories. Versions before 10.0.2 fail to properly escape user-controlled input in directory listing pages, allowing attackers to inject malicious JavaScript code that executes in visitors' browsers. This can lead to credential theft, session hijacking, or defacement of the served content.
Technical details
The vulnerability is a reflected Cross-Site Scripting (XSS) flaw (CWE-79) in the directory listing template (directory.jst) that fails to encode output when rendering user-supplied input such as directory names. An attacker can craft a malicious directory name containing JavaScript payload; when a victim visits the directory listing page, the unescaped payload executes in their browser context with the same privileges as the serve application. The fix (commit 65b4d41) properly escapes template variables using the `{{ = ... }}` template syntax. Exploitation requires only network access to the serve instance and no authentication.
Affected products
- Vercel serve < 10.0.2
Timeline
- 2020-09-11: disclosed
- 2020-09-11: patched: Fixed in version 10.0.2